GitHub Advanced Security exam guide: plan for GH-500 with hands-on security workflows
The GitHub Advanced Security certification validates the ability to use GHAS to secure code, secrets, and dependencies across the software development lifecycle. It suits administrators, developers, DevOps engineers, solution architects, and students who already understand GitHub fundamentals, CI/CD, and secure-development concepts. Use this guide to decide whether your current experience is sufficient, build a practice plan around the assessed domains, and schedule the proctored assessment with fewer avoidable surprises.
Decide whether GH-500 matches your work
GH-500 is an intermediate-level GitHub certification for people who can configure security features, investigate alerts, remediate issues, and use policies, workflows, and automation to prevent recurring risk. It is a better fit for a candidate who has worked through the security consequences of a repository change than for someone whose experience is limited to reading feature descriptions.
The intended audience includes administrators, developers, DevOps engineers, solution architects, and students. Those titles do not represent separate tracks. The common requirement is practical familiarity with protecting code, secrets, and dependencies throughout the development lifecycle.
A useful readiness check is to ask whether you can explain the operational path behind each security finding. For a dependency issue, can you distinguish detection from a proposed update, assess the change before it is merged, and decide how the work should be prioritized? For a secret finding, can you explain both response and prevention? For code scanning, can you connect a result to configuration and remediation rather than treating the alert as an isolated screen?
Do not interpret the word intermediate as a reason to skip foundational GitHub knowledge. Microsoft identifies GitHub fundamentals, CI/CD, and secure development concepts as expected background. If repository permissions, pull requests, Actions, dependency changes, or security terminology are unfamiliar, close those gaps before spending most of your time on exam-specific revision.
What the certification is validating
The assessment focuses on using GitHub Advanced Security as part of a security workflow, not merely naming its features. Candidates are expected to configure security capabilities, triage and remediate alerts, and apply prevention-first practices through policies, workflows, and automation.
GHAS is described as an add-on to GitHub Enterprise that enables security capabilities such as secret scanning, code scanning, and dependency management for private repositories. Microsoft also states that GHAS is available for enterprise accounts on GitHub Enterprise Cloud and GitHub Enterprise Server, while some features are available for public repositories on GitHub.com. That availability context matters when interpreting architecture and administration scenarios.
Understand the security model before memorizing settings
Start by separating the security suites, their inputs, and the decisions each one supports. This prevents a frequent preparation error: treating secret protection, supply-chain security, and code security as different labels for the same alert-management process.
Code scanning uses CodeQL or a third-party tool to find potential vulnerabilities and coding errors. Secret scanning detects secrets such as keys and tokens checked into repositories. Dependency review shows the impact of dependency changes and details about vulnerable versions before a pull request is merged. Dependabot alerts notify teams when code relies on packages with known security vulnerabilities and can generate pull requests to update vulnerable dependencies.
This distinction produces more reliable exam reasoning. A finding in code is not the same kind of evidence as a credential committed to a repository, and neither is the same as a vulnerable package introduced by a dependency change. Begin by identifying what has been detected, then identify the appropriate feature, configuration, alert workflow, and preventive control.
The Security Overview and the relationship between security suites are included in the skills measured. Study them as an operating model: repository-level detection produces information that must be interpreted and acted on, while organization or enterprise administration helps establish consistent coverage and policy. Avoid learning options as a disconnected list.
Public and private repository context
Feature availability is a reasoning point, not a licensing trivia question. Microsoft states that most GHAS features are free for public GitHub repositories and that private repositories require a GHAS license. The official material also notes that some GHAS features are available for public repositories on GitHub.com.
When reviewing a scenario, establish the repository and enterprise context before selecting an action. A technically plausible recommendation can still be incomplete if it ignores whether the question concerns a public repository, a private repository, or an enterprise environment.
General availability and Preview features
Build your core notes around generally available functionality. The GH-500 study guide says that most questions cover general availability features, although commonly used Preview features can appear. This is a reason to understand frequently encountered Preview capabilities in context, not a reason to let unconfirmed previews dominate your preparation.
Use the current study guide as the control document when a training module, older note, or third-party explanation uses previous terminology. The official domains explicitly identify former names for Secret Protection, supply-chain security, and Code Security; retain both names in your notes so that terminology changes do not obscure the underlying workflow.
Use the measured domains to allocate study time
Organize revision by the official domains and make each domain produce a practical outcome: a configuration decision, an alert-triage decision, a policy decision, or a remediation plan. The published ranges guide emphasis, but they are not a promise of a fixed number of questions in any sitting.
Domain 1, Describe GitHub Security Suites, Features, and Ecosystem, is weighted 15–20%. It covers the suite structure and navigation, the distinctions among Code Security, Secret Protection, and Supply Chain Security, feature availability across repository and enterprise contexts, Security Overview, and secure SDLC strategy. Use this domain to build the conceptual map that supports the rest of the exam.
Domain 2, Configure and Use Secret Protection, is weighted 15–20%. Prepare to connect secret detection with appropriate response and preventive practices, rather than studying secret scanning as a one-step feature. Be ready to reason about how policies and workflows reduce the chance that sensitive data reaches a repository.
Domain 3, Configure and Use Supply Chain Security, is weighted 15–20%. Focus on dependencies as a security-management problem: recognizing vulnerable dependency information, evaluating dependency changes, using alerts and updates appropriately, and prioritizing the work that follows.
Domain 4, Configure and Use Code Security, is weighted 10–15%. Study the role of code scanning and CodeQL, including how code scanning can be implemented with CodeQL, third-party tools, and GitHub Actions. Treat analysis configuration and alert remediation as connected tasks.
Domain 5, Security Operations: Best Practices, Prioritization, and Remediation, is weighted 15–20%. This domain is where feature knowledge becomes operational judgment. Practice sorting alerts, selecting a response, and identifying prevention-first changes that can reduce repeated exposure.
Domain 6, GitHub Security Suites Administration, is weighted 10–15%. Include the organizational rollout and administration perspective in your preparation. The official Part 2 learning path specifically includes GHAS administration and how GHAS fits into the software development lifecycle.
Turn percentages into an efficient plan
Give every domain deliberate attention. The domains weighted 15–20% deserve substantial practice because they combine broad concepts with configuration and response decisions, but Domain 4, Configure and Use Code Security, and Domain 6, GitHub Security Suites Administration, remain assessed material and should not become last-minute reading.
A sensible practical approach is to begin with Domain 1, then work through Secret Protection, supply-chain security, and Code Security as separate detection-to-remediation workflows. Follow with security operations, where you compare the workflows and decide what to address first. Finish with administration, which joins repository-level capability to broader rollout and governance decisions. This sequence reduces duplicate note-taking and makes later scenario work easier.
Build experience through small, repeatable workflows
Hands-on practice should prove that you can make and explain decisions, not just reproduce a sequence of clicks. The official learning paths require a GitHub account and a basic understanding of GitHub fundamentals. Use an environment where you can safely inspect repository security features and trace how a change becomes an alert, review item, or remediation task.
For each practice session, write a short record with four fields: the security signal, the feature that produced it, the immediate response, and the preventive follow-up. This format exposes weak understanding quickly. If you can name a tool but cannot identify what it detected or what should happen next, revisit the workflow.
Keep practice centered on authorized repositories and test material. The target is professional competence with configuration, triage, remediation, policies, workflows, and automation. Unofficial question collections cannot replace this work, and memorized answers do not demonstrate that you can interpret a new scenario.
Practice secret protection as a response cycle
Create notes that separate discovery, containment, remediation, and prevention. Secret scanning is designed to detect secrets such as keys and tokens committed to private repositories. A preparation exercise should therefore ask more than whether a secret was found: what must be investigated, what action resolves the exposure, and what policy or workflow can help prevent recurrence?
Do not collapse this workflow into generic vulnerability language. A secret is sensitive data that may require a response different from a code defect or an outdated dependency. In scenario practice, identify the artifact first, then evaluate the relevant control and next action.
Practice supply-chain decisions before merge and after alerting
Use dependency review to reason about a proposed dependency change before a pull request is merged. Microsoft describes dependency review as showing the full impact of dependency changes and details of vulnerable versions. Pair that knowledge with Dependabot alert workflows, which identify dependencies with known security vulnerabilities and can generate pull requests to update them.
A common mistake is to assume every update should be treated as an automatic merge decision. Exam preparation should instead model the sequence: identify the affected dependency, understand what the proposed change means, assess the security signal, and select the appropriate review or remediation action. The point is to use security information in the development workflow, not to bypass engineering judgment.
Practice code security from analysis to action
Code scanning is a static-analysis workflow, not simply a report. The official materials identify CodeQL, third-party tools, and GitHub Actions as ways to implement code scanning. Practice explaining why a particular configuration or analysis approach is relevant, how findings are surfaced, and how remediation is connected to the security result.
Do not overfocus on CodeQL terminology at the expense of operational use. The assessed area is Configure and Use Code Security, and the learning path includes identifying vulnerabilities in a codebase with CodeQL and using code scanning with GitHub CodeQL. Your notes should link implementation choices to the goal of finding and addressing potential vulnerabilities and coding errors.
Follow a practical study roadmap
Use a staged roadmap that alternates structured learning, hands-on reinforcement, and decision-based review. The official Microsoft Learn paths offer a ready-made backbone, while your own practice should supply the context that turns modules into exam-ready judgment.
The two official learning paths each contain four modules. Part 1 is listed at 2 hours and 3 minutes and covers the GHAS introduction, Dependabot security updates, secret scanning, and code scanning. Part 2 is listed at 3 hours and 51 minutes and covers CodeQL-based vulnerability identification, CodeQL code scanning, GHAS administration, and sensitive data and security policies. Use the module sequence as a checklist, not as a substitute for practice.
Stage 1: establish the feature map
Complete the introductory material and produce a one-page comparison of Code Security, Secret Protection, and Supply Chain Security. Include what each area is intended to detect, where it fits in the development lifecycle, and the kind of action it supports. Add the public-versus-enterprise availability context from the official materials.
At the end of this stage, explain Security Overview and the relationship among the suites without consulting notes. If the explanation is vague, do not move straight to question practice. A weak feature map makes later configuration scenarios appear more complicated than they are.
Stage 2: learn one workflow at a time
Study Dependabot security updates and dependency review together, but keep their roles distinct. Then study secret scanning and its prevention-oriented controls. Follow with code scanning, including CodeQL and the supported implementation context named in the learning path. After each block, write two or three scenario prompts of your own that require a choice and a reason.
For example, frame prompts around an incoming dependency change, a secret exposed in a repository, or a potential code vulnerability. Do not invent product behavior for the answer; use the prompt to check that you can select the right security area, explain the available evidence, and name a sensible remediation or prevention direction.
Stage 3: add operations and administration
Now shift from individual alerts to a portfolio view. Practice prioritization and remediation reasoning, including how policies, workflows, and automation can support prevention-first security practices. Then revisit organization-level administration and rollout, using the Part 2 material on GHAS administration.
This stage is where candidates often discover an imbalance. A developer may know how to interpret a finding but be less confident with broader security-suite administration. An administrator may understand rollout but need more fluency with the details of alert handling. Use that diagnosis to direct your final revision rather than repeating every module equally.
Stage 4: test decisions, not recall
Use the official practice assessment to identify knowledge gaps and the official exam sandbox to become familiar with the question interface. Microsoft describes the practice assessment as a way to gauge the style, wording, and difficulty of likely questions and determine where further preparation is needed.
Review incorrect or uncertain answers by returning to the relevant domain and workflow. Record why the correct direction fits the security signal and why a tempting alternative belongs to another suite, another stage of the lifecycle, or a different administrative scope. That review method is more durable than collecting answer patterns.
Avoid preparation mistakes that create false confidence
The highest-value correction is to replace feature-name recall with cause-and-response reasoning. GH-500 covers configuration, alert triage, remediation, policies, workflows, automation, and administration; a study plan that only watches training content leaves those decisions underpracticed.
Another mistake is studying only the security area closest to your job. A developer who concentrates exclusively on code scanning may miss supply-chain and administration concepts. A security administrator who focuses solely on policies may be unprepared to distinguish dependency review, Dependabot alerts, secret scanning, and code scanning in a repository scenario.
Do not use old names as if they describe different current domains. The official blueprint identifies Secret Protection as formerly secret scanning, supply-chain security as formerly Dependabot/Dependency Review, and Code Security as formerly Code Scanning with CodeQL. Keep a terminology cross-reference so older learning materials do not create needless confusion.
Finally, avoid scheduling based on completion of training alone. Schedule when you can explain the suite model, work through each security workflow, and identify specific remaining weak domains using practice results. Completion is an input to readiness; it is not evidence that every measured skill is secure.
A final readiness checklist
Before booking, confirm that you can distinguish the three security suites and explain their place in a secure SDLC; reason about public repository and enterprise contexts; configure and use secret, supply-chain, and code security capabilities; and connect alerts to prioritization, remediation, policies, workflows, and automation.
Also confirm that you can discuss GHAS administration and rollout at an organization level. If any point produces a list of vague product terms instead of a clear decision process, return to the corresponding module and create a short hands-on or scenario-based exercise for that gap.
Plan registration and the assessment experience
The GH-500 assessment is proctored and allows 100 minutes for completion. Microsoft states that the exam is provided by Microsoft, while the exam and associated certification are maintained by GitHub. Use the official certification page when you are ready to schedule because availability and the applicable process can change.
The assessment is listed in English, Spanish, Portuguese (Brazil), Korean, and Japanese. If the exam is not available in a preferred language, the study guide states that candidates can request an additional 30 minutes. The same guide notes that localized exam versions may be updated approximately eight weeks after an English update, although this timing is not guaranteed.
Microsoft recommends registering with a personal MSA account. Its stated reason is that records associated with an organizational work or school AAD account can be lost and unrecoverable if you leave that organization. Connect the certification profile to Microsoft Learn so you can schedule and renew exams and share or print certificates.
Exam price is based on the country or region where the exam is proctored, so check the official scheduling page rather than relying on an amount quoted elsewhere. If a first attempt is unsuccessful, the official certification page says a candidate may retake the exam after 24 hours; later retake timing varies under the retake policy.
Use the official tools before exam day
Launch the official exam sandbox before the assessment. It is intended to let candidates experience the look and feel of the exam and interact with question types in the same user interface. This is a low-effort way to remove interface unfamiliarity from your preparation plan.
Treat the published passing requirement as a reporting threshold, not a study target. The GH-500 study guide states that a score of 700 or greater is required to pass. Aim instead for consistent command of the measured workflows, especially where configuration, prioritization, remediation, and administration overlap.
Keep the blueprint current
The official study guide identifies the skills measured as of July 2026. Recheck that guide shortly before you schedule and again before final revision, particularly if your notes use older domain labels or older feature terminology. The guide is designed to summarize topics that might be covered and to focus study efforts.
If you earn the certification, plan for maintenance rather than treating the result as permanent. The study guide states that Microsoft associate, expert, and specialty certifications expire annually and can be renewed by passing a free online assessment on Microsoft Learn. Review the certification page and your profile for the current renewal workflow.
Choose your next action
Start with a short skills audit, then choose the smallest action that resolves the largest gap. Candidates new to GHAS should begin with the Part 1 learning path and a feature comparison. Candidates who already use alerts should prioritize the domains they have not administered or configured directly. Candidates nearing readiness should use the practice assessment, review weak areas by domain, and use the sandbox before scheduling.
Keep the final week focused on scenario reasoning. Revisit how a repository condition becomes a security signal, how that signal should be triaged, what remediation direction fits, and which policy, workflow, automation, or administration decision reduces repeat risk. That connects the official blueprint to the work GH-500 is intended to validate.
Conclusion
GH-500 preparation is strongest when it follows the real operating flow of GitHub Advanced Security: understand the security suite, configure the relevant capability, interpret the signal, remediate the issue, and improve prevention through policies, workflows, automation, and administration. Use the official study guide as the scope boundary, the Microsoft Learn paths as structured instruction, and authorized hands-on practice to test your decisions before you schedule.
Related exams
- GitHub-Actions exam — GitHub Actions Certificate Exam
- GitHub-Copilot exam — GitHub CopilotCertification Exam
- GitHub-Foundations exam — GitHub FoundationsExam
